The Bulgarian Cybersecurity Act (promulgated in State Gazette No. 94 of 13 November 2018, as amended and supplemented, SG No. 17 of 13 February 2026) is the principal legislative act governing the protection of network and information systems, cyber risk management, and coordination among competent authorities in the Republic of Bulgaria.
Initially, the Act transposed Directive (EU) 2016/1148 (NIS). With the substantial amendments adopted in 2026, the requirements of Directive (EU) 2022/2555 (NIS 2) were introduced into national legislation. NIS 2 significantly expands the scope of obligated entities, introduces stricter risk management requirements, and strengthens supervisory and sanctioning mechanisms.
The Bulgarian Cybersecurity Act establishes the legal framework for achieving a high common level of cybersecurity in the Republic of Bulgaria, sets out specific obligations for public authorities and businesses, and is aligned with:

• Directive (EU) 2022/2555 (NIS 2);
• Directive (EU) 2022/2557 on the resilience of critical entities (CER);
• Regulation (EU) 2019/881 on ENISA and on ICT cybersecurity certification (EU Cybersecurity Act);
• Regulation (EU) 2022/2554 (DORA) on digital operational resilience in the financial sector.

The Act defines:

• the requirements applicable to administrative authorities and certain public and private entities;
• cybersecurity risk management measures;
• obligations to report significant incidents;
• the powers of the national competent authorities;
• supervisory mechanisms and administrative liability.

The cybersecurity system forms part of the national security protection framework and is managed by the Council of Ministers through the Cybersecurity Council and the National Cybersecurity Coordinator.
 
Scope of Application
Following the 2026 amendments, the scope of the Act has been significantly expanded.
The Act applies, inter alia, to:
1. Administrative authorities
All bodies within the executive branch, as well as certain other public entities.
2. Public and private entities in the sectors listed in Annexes I and II
Medium-sized and large enterprises operating in key sectors, including:

• Energy;
• Transport;
• Banking and financial market infrastructures;
• Healthcare;
• Drinking water supply and wastewater;
• Digital infrastructure;
• ICT services (cloud services, data centres, DNS, CDN, managed services, etc.);
• Manufacturing of critical products;
• Public administration bodies and other entities providing administrative services;
• Waste management and other strategic activities.

3. Entities listed in Annexes I and II, regardless of size, where:

• They are providers of public electronic communications networks or services;
• They are trust service providers;
• They are top-level domain name registries or DNS service providers;
• They are the sole provider of an essential service;
• A disruption of the service would affect public safety, security, or health;
• A disruption would result in significant systemic risk or cross-border impact;
• They are critical due to national or regional significance.

4. Critical entities
Organisations identified as critical entities within the meaning of Directive (EU) 2022/2557.
5. Domain name registration service providers
6. Educational institutions
Where they conduct research activities of critical importance in the sectors listed in Annexes I and II.
7. Persons exercising public functions
Where they provide administrative services electronically.
8. Organisations providing public services
Where they provide administrative services electronically.
9. Judicial authorities
 
Exclusions from Scope
The Act does not apply to:

1. Communication and information systems processing classified information within the meaning of the Classified Information Protection Act;
2. Network and information systems of the Ministry of Defence and its subordinate structures, the Bulgarian Armed Forces, the Ministry of Interior, the State Agency for National Security (SANS), the State Intelligence Agency, the State Agency for Technical Operations, the Commission for Counteracting Corruption, and the National Protection Service, where such systems are not related to the provision of electronic administrative services or the exchange of electronic documents between administrative authorities.

Under the current framework, enterprises providing public electronic communications networks and/or services and trust service providers fall within the scope of the Act under the conditions set therein.
 
Essential and Important Entities
The Act introduces a distinction between:

• Essential entities
• Important entities

Classification is determined based on the sector concerned, the size of the entity, and the criticality of the services provided. The distinction primarily affects the intensity of supervision and the severity of sanctions, with essential entities subject to stricter and more proactive oversight.
In practice, this means that a significantly broader range of organisations is now subject to mandatory cybersecurity measures and state supervision.
 
Key Obligations of Organisations
1. Risk Management
Essential and important entities are required to implement appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risks.
At a minimum, such measures must cover:

• risk analysis and assessment policies;
• incident handling;
• business continuity and disaster recovery;
• supply chain security;
• security in system development and maintenance;
• vulnerability handling and disclosure;
• access control policies and asset management;
• use of cryptography and encryption;
• multi-factor authentication;
• training and cyber hygiene.

The measures must ensure a level of security appropriate to the identified risks.

2. Role of the Management Body
The management body bears direct responsibility for:

• approving cybersecurity risk management measures;
• overseeing their implementation;
• undergoing periodic training on cyber risk management.

This represents a substantial shift: cybersecurity is now a matter of executive accountability, rather than solely an IT function.
 
Incident Reporting Obligations
In the event of a significant incident, affected entities must notify the relevant sectoral Computer Security Incident Response Team (CSIRT) as follows:

1. Early warning – within 24 hours of becoming aware of the incident;
2. Incident notification – within 72 hours (24 hours for trust service providers);
3. Intermediate report – upon request;
4. Final report – within one month.

The Act also provides for voluntary notification of cyber threats and near-incidents.
 
Supervision and Enforcement
Supervisory and enforcement powers are exercised by the national competent authorities, the Ministry of Electronic Governance, the Ministry of Interior, the Ministry of Defence, and the State Agency for National Security within the scope of their respective statutory powers.
Supervisory measures include:

• planned and ad hoc inspections;
• security audits;
• requests for evidence and documentation;
• binding instructions;
• temporary suspension of activities in cases of serious violations.

 
Sanctions
The Bulgarian Cybersecurity Act provides for significant administrative penalties in cases of non-compliance by essential and important entities.
The financial penalties, aligned with NIS 2 requirements, are as follows:

• For essential entities – up to EUR 10,000,000 or up to 2% of the total worldwide annual turnover of the preceding financial year (whichever is higher, but not less than the statutory minimum);
• For important entities – up to EUR 7,000,000 or up to 1.4% of the total worldwide annual turnover of the preceding financial year (whichever is higher, but not less than the statutory minimum).

Personal administrative liability is also provided for members of management bodies who fail to approve and oversee the implementation of cybersecurity measures.
 
Practical Implications for Organisations
In practical terms, the Bulgarian Cybersecurity Act requires organisations to:

• implement a formalised cyber risk management framework;
• establish structured incident management procedures;
• integrate cybersecurity into corporate governance;
• clearly allocate responsibilities to management bodies and senior leadership;
• align requirements under the Cybersecurity Act and DORA (for financial sector entities);
• establish structured interaction with public authorities;
• prepare for inspections and audits.

 
How CONSEJO Can Support You
The CONSEJO team provides expert support in:

• conducting a IT audit;
• developing and implementing policies and procedures;
• preparing for audits and inspections;
• training management and expert personnel.

👉 Contact us today to ensure full and effective compliance with the Bulgarian Cybersecurity Act.
 

Bulgarian Cybersecurity Act